CVE-2025-8446

Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install

Published Sep 16, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability.

Analysis

Technical impact

The Blaze Demo Importer plugin for WordPress contains a function called blaze_demo_importer_install_plugin that performs no capability check. As a result, any authenticated user with Subscriber level or higher can invoke the function to install and activate a small, predefined set of plugins. The plugin specifically allows the installation of the News Kit Elementor Addons plugin and a BlazeThemes theme. The impact is limited to these particular installations and does not provide full arbitrary plugin deployment or direct code execution.

Affected Systems

WordPress sites running Blaze Demo Importer version 1.0.12 or earlier are affected. The vulnerability can only be exploited if the News Kit Elementor Addons plugin and a BlazeThemes theme are already installed and activated on the same site, as these are required components of the exploit path.

Risk and Exploitability

The overall severity is medium with a CVSS score of 4.3 and an EPSS score below 1%, indicating a low likelihood of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While the attack vector requires user authentication at the Subscriber level or higher, the limited scope of exploitable plugins reduces the potential breadth of impact, yet still poses a tangible risk for sites that have the required components installed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

blazethemes

Blaze Demo Importer

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.12

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Blaze Demo Importer to a version that includes the missing capability check
If an upgrade is not possible, remove or deactivate the News Kit Elementor Addons plugin and any BlazeThemes theme that could satisfy the exploit requirements
Add a custom code snippet that disables blaze_demo_importer_install_plugin or restricts its execution to administrator‐level users to restore proper authorization

Generated by OpenCVE AI on April 21, 2026 at 19:05 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-29548	The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.240% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/blaze-demo-importer/trunk/blaze-demo-importer.php#L91
https://plugins.trac.wordpress.org/changeset/3361179/
https://www.wordfence.com/threat-intel/vulnerabilities/id/a91bd1cf-ac63-4d65-b9fc-3fa2507cc27e?source=cve

History

Sep 17, 2025 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Sep 16, 2025 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 16, 2025 11:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability.
Title		Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/blaze-demo-importer/trunk/blaze-demo-importer.php#L91 https://plugins.trac.wordpress.org/changeset/3361179/ https://www.wordfence.com/threat-intel/vulnerabilities/id/a91bd1cf-ac63-4d65-b9fc-3fa2507cc27e?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`